Victims of the 2023 data breach at genetic testing company 23andMe are set to receive compensation under a $46.75 million settlement approved through the company’s bankruptcy proceedings. Court records show that $32.5 million will be used to resolve consolidated class-action lawsuits, while nearly $14.3 million has already been transferred to settlement administrator Kroll. Approximately $13 million of that amount came from cyber insurance coverage provided by multiple insurers, highlighting the significant role insurance plays in responding to large-scale privacy and cybersecurity incidents.
For claims professionals, the case illustrates how cyber insurance policies continue to absorb substantial costs associated with data breaches, including litigation and settlement expenses. The matter also demonstrates the challenges insurers face when losses involve highly sensitive personal information such as genetic data. Coverage questions, claimant verification, damages assessments, and privacy-related exposures remain key issues in these types of claims.
The settlement comes amid ongoing bankruptcy proceedings involving the company now known as Chrome Holding Co. The court noted that pursuing the full amount sought by plaintiffs could have resulted in years of costly litigation and further depleted estate assets. The agreement represents a compromise designed to preserve resources while providing compensation to affected consumers.
Claims administration remains a significant undertaking. More than 255,000 claims have reportedly been resolved, yet thousands remain outstanding. Rather than providing uniform payments, the settlement establishes a tiered compensation structure, with awards ranging from $50 to as much as $10,000 for extraordinary claims. This approach reflects the ongoing industry challenge of evaluating damages in privacy and cyber-related losses, where claimant impacts can vary significantly.
The breach itself affected nearly half of 23andMe’s customer base and exposed information associated with DNA Relatives and Family Tree features. The case continues to generate regulatory scrutiny, including a recent lawsuit filed by California alleging failures to adequately protect customer data. The outcome will likely be closely watched by insurers, cyber risk professionals, and claims handlers managing future privacy and data breach exposures.
